Sign in

Lee Holmes

@leeholmes.com
93 followers 103 following 42 posts

Partner Security Architect, Azure Security. PowerShell developer, fanatical hobbyist, and author of the PowerShell Cookbook.

PostsRepliesMedia
Lee Holmes @leeholmes.com · 22/09/2026
Wow, had a fantastic time at Blue Team Con. Every year, the conference finds a way to get better. It's so refreshing to have a conference with talks based on concrete, hard-won lessons for defenders.
110
Lee Holmes @leeholmes.com · 10/09/2026
Holy shit. If you thought SIM swapping was a problem, you wouldn't believe the gaping mess of enacting a Power of Attorney. POA lets family members / care givers get access to somebody's bank accounts etc., and it's ridiculous. A few forged documents / phone calls is all it takes.
010
Lee Holmes @leeholmes.com · 04/08/2026
Ok, finally captured some thoughts about our new book, Threat Driven Software Development here: www.leeholmes.com/threat-drive.... If you are a Blue Teamer working on developing or securing online services - this is your jam and I hope you enjoy it.
leeholmes.com
Threat Driven Software Development
If you’re a Blue Teamer trying to write secure services or secure an organization that does, Threat Driven Software Development is the book you’ve been looking for. This was a deep collaboration betwe...
010
Lee Holmes @leeholmes.com · 06/06/2026
It's alive! If you're a Blue Teamer trying to write secure services or secure an organization that does, Threat Driven Software Development is the book you've been looking for. www.amazon.com/dp/0135567386
amazon.com
Threat-Driven Software Development: Defending online services from modern threat actors
Threat-Driven Software Development: Defending online services from modern threat actors
062
Reposted by Lee Holmes
Microsoft Security Response Center @msrc.microsoft.com · 10/04/2026
🗓️ Mark your calendars 🗓️ BlueHat is headed to Singapore, September 17–18. Call for Papers and registration announcements coming soon. 👀
045
Reposted by Lee Holmes
Barry Dorrans @blowdart.me · 09/04/2026
I still love making bounty payouts though. It's the best bit of my job.
092
Lee Holmes @leeholmes.com · 20/02/2026
Artwork is not final yet, but I can't wait! The amount of battle tested content in this book is unbelievable. And by battle tested, I mean it. Name an APT and Microsoft has had to defend against them.
Book cover for "Threat Driven Software Development: Defending online services from modern threat actors." Colors are primarily blue, with a depiction of an attack graph.
120
Lee Holmes @leeholmes.com · 10/02/2026
Sweet! BlueHat Redmond has kicked off its CFP! BlueHat brings together security researchers and responders to exchange ideas and best practices - including vulnerability research, mitigations, emerging threats, techniques, and more. Submit your paper by February 28, 2026: aka.ms/BH26CFP
000
Lee Holmes @leeholmes.com · 30/01/2026
So freakin' excited. Have a book coming out with Michael Howard (author of Writing Secure Code), Sherrod DeGrippo (Director of Threat Intelligence at Microsoft) and Shawn Hernan (Director of Azure's Security Assurance organization).
140
Lee Holmes @leeholmes.com · 21/01/2026
Wow, what an amazing impact @jsnover.com has had on the security industry and everybody that's had the privilege to work with him. Jeffrey's leadership was directly responsible for:
171
Lee Holmes @leeholmes.com · 16/01/2026
Wife: "Whoa, Lewis Hamilton is getting a new race engineer this season" Me: "Who?" Wife: "🏎️🐎 We are checking... 🐎🏎️"
030
Lee Holmes @leeholmes.com · 16/01/2026
25 years ago is 2001. I joined Microsoft on the Encarta Encyclopedia team in 2002 and asked as part of my interviews: "So what are you going to do about this Wikipedia thing?"
100
Lee Holmes @leeholmes.com · 15/01/2026
Ever seen a demoscene demo in APL? Now you have. www.leeholmes.com/apl-demoscene/
000
Lee Holmes @leeholmes.com · 24/09/2025
Had a huge YouTuber (IShowSpeed, 44M subs) come to a place I was at last night. It was madness. Dozens (200?) of kids and teens swarming, screaming his name, and calling his cliches out to him. He seemed like a nice enough guy, and his security mostly kept the mob from interrupting the rest of us.
IShowSpeed about to approach a crowd of fans
010
Lee Holmes @leeholmes.com · 10/09/2025
Have you seen how PowerShell Core now sends de-obfuscated .NET API calls to the AMSI stream?
The following console contetn: [Console]::(-join (294,291,312,293,308,317,312,319,308 | % { [char] ($_ -bxor 337) }))("Hello World")

With a debug message showing what is being sent to AMSI:

=== Amsi notification report content ===
<System.Console>.WriteLine(<Hello World>)
=== Amsi notification report success: True ===
030
Lee Holmes @leeholmes.com · 10/09/2025
One of the little pet projects I'm proudest of - extremely simple comment system for static sites: www.leeholmes.com/statique-sim...
leeholmes.com
Statique: Simple Self-Hosted Comments for Static Websites
When hosting a static website or blog, you ultimately have to tackle the question: “What about the comments?
010
Lee Holmes @leeholmes.com · 08/09/2025
I could watch stuff like this all day. The world needs more fixers.
Construction workers ashphalting a road.
000
Lee Holmes @leeholmes.com · 08/09/2025
Smart way for Chicago to protect the crowds at this weekend's Taste of Chicago festival from the monsters that try to mow them down.
A line of dump trucks, full, nose-to-tail, parked on the side of the street protecting a park.
021